* [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro [not found] <20160701001209.7DA24D1C@viggo.jf.intel.com> @ 2016-07-01 0:12 ` Dave Hansen 2016-07-01 9:23 ` Borislav Petkov 0 siblings, 1 reply; 6+ messages in thread From: Dave Hansen @ 2016-07-01 0:12 UTC (permalink / raw) To: linux-kernel Cc: x86, linux-mm, torvalds, akpm, bp, ak, mhocko, Dave Hansen, dave.hansen, luto, stable From: Dave Hansen <dave.hansen@linux.intel.com> epufeatures.h currently defines X86_BUG(9) twice on 32-bit: #define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */ ... #ifdef CONFIG_X86_32 #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ #endif I think what happened was that this added the X86_BUG_ESPFIX, but in an #ifdef below most of the bugs: [58a5aac5] x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled Then this came along and added X86_BUG_NULL_SEG, but collided with the earlier one that did the bug below the main block defining all the X86_BUG()s. [7a5d6704] x86/cpu: Probe the behavior of nulling out a segment at boot time Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Acked-by: Andy Lutomirski <luto@kernel.org> Cc: stable@vger.kernel.org --- b/arch/x86/include/asm/cpufeatures.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff -puN arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros arch/x86/include/asm/cpufeatures.h --- a/arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros 2016-06-30 17:10:41.215185869 -0700 +++ b/arch/x86/include/asm/cpufeatures.h 2016-06-30 17:10:41.218186005 -0700 @@ -301,10 +301,6 @@ #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ -#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */ -#define X86_BUG_SWAPGS_FENCE X86_BUG(10) /* SWAPGS without input dep on GS */ - - #ifdef CONFIG_X86_32 /* * 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional @@ -312,5 +308,7 @@ */ #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ #endif +#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */ +#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */ #endif /* _ASM_X86_CPUFEATURES_H */ _ -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro 2016-07-01 0:12 ` [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro Dave Hansen @ 2016-07-01 9:23 ` Borislav Petkov 2016-07-01 16:30 ` Andy Lutomirski 0 siblings, 1 reply; 6+ messages in thread From: Borislav Petkov @ 2016-07-01 9:23 UTC (permalink / raw) To: Dave Hansen Cc: linux-kernel, x86, linux-mm, torvalds, akpm, ak, mhocko, dave.hansen, luto, stable On Thu, Jun 30, 2016 at 05:12:10PM -0700, Dave Hansen wrote: > > From: Dave Hansen <dave.hansen@linux.intel.com> > > epufeatures.h currently defines X86_BUG(9) twice on 32-bit: > > #define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */ > ... > #ifdef CONFIG_X86_32 > #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ > #endif > > I think what happened was that this added the X86_BUG_ESPFIX, but > in an #ifdef below most of the bugs: > > [58a5aac5] x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled > > Then this came along and added X86_BUG_NULL_SEG, but collided > with the earlier one that did the bug below the main block > defining all the X86_BUG()s. > > [7a5d6704] x86/cpu: Probe the behavior of nulling out a segment at boot time > > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> > Acked-by: Andy Lutomirski <luto@kernel.org> > Cc: stable@vger.kernel.org > --- > > b/arch/x86/include/asm/cpufeatures.h | 6 ++---- > 1 file changed, 2 insertions(+), 4 deletions(-) > > diff -puN arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros arch/x86/include/asm/cpufeatures.h > --- a/arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros 2016-06-30 17:10:41.215185869 -0700 > +++ b/arch/x86/include/asm/cpufeatures.h 2016-06-30 17:10:41.218186005 -0700 > @@ -301,10 +301,6 @@ > #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ > #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ > #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ > -#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */ > -#define X86_BUG_SWAPGS_FENCE X86_BUG(10) /* SWAPGS without input dep on GS */ > - > - > #ifdef CONFIG_X86_32 > /* > * 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional So I'd remove the "#ifdef CONFIG_X86_32" ifdeffery too and make that bit unconditional - so what, we have enough free bits. But I'd leave the comment to still avoid the confusion :) -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro 2016-07-01 9:23 ` Borislav Petkov @ 2016-07-01 16:30 ` Andy Lutomirski 2016-07-01 16:46 ` Borislav Petkov 0 siblings, 1 reply; 6+ messages in thread From: Andy Lutomirski @ 2016-07-01 16:30 UTC (permalink / raw) To: Borislav Petkov Cc: Michal Hocko, linux-kernel@vger.kernel.org, stable, Andi Kleen, linux-mm@kvack.org, Linus Torvalds, Andrew Morton, X86 ML, Dave Hansen, Dave Hansen On Jul 1, 2016 2:23 AM, "Borislav Petkov" <bp@alien8.de> wrote: > > On Thu, Jun 30, 2016 at 05:12:10PM -0700, Dave Hansen wrote: > > > > From: Dave Hansen <dave.hansen@linux.intel.com> > > > > epufeatures.h currently defines X86_BUG(9) twice on 32-bit: > > > > #define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */ > > ... > > #ifdef CONFIG_X86_32 > > #define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ > > #endif > > > > I think what happened was that this added the X86_BUG_ESPFIX, but > > in an #ifdef below most of the bugs: > > > > [58a5aac5] x86/entry/32: Introduce and use X86_BUG_ESPFIX instead of paravirt_enabled > > > > Then this came along and added X86_BUG_NULL_SEG, but collided > > with the earlier one that did the bug below the main block > > defining all the X86_BUG()s. > > > > [7a5d6704] x86/cpu: Probe the behavior of nulling out a segment at boot time > > > > Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> > > Acked-by: Andy Lutomirski <luto@kernel.org> > > Cc: stable@vger.kernel.org > > --- > > > > b/arch/x86/include/asm/cpufeatures.h | 6 ++---- > > 1 file changed, 2 insertions(+), 4 deletions(-) > > > > diff -puN arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros arch/x86/include/asm/cpufeatures.h > > --- a/arch/x86/include/asm/cpufeatures.h~knl-leak-10-fix-x86-bugs-macros 2016-06-30 17:10:41.215185869 -0700 > > +++ b/arch/x86/include/asm/cpufeatures.h 2016-06-30 17:10:41.218186005 -0700 > > @@ -301,10 +301,6 @@ > > #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ > > #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ > > #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ > > -#define X86_BUG_NULL_SEG X86_BUG(9) /* Nulling a selector preserves the base */ > > -#define X86_BUG_SWAPGS_FENCE X86_BUG(10) /* SWAPGS without input dep on GS */ > > - > > - > > #ifdef CONFIG_X86_32 > > /* > > * 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional > > So I'd remove the "#ifdef CONFIG_X86_32" ifdeffery too and make that bit > unconditional - so what, we have enough free bits. But I'd leave the > comment to still avoid the confusion :) > I put the ifdef there to prevent anyone from accidentally using it in a 64-bit code path, not to save a bit. We could put in the middle of the list to make the mistake much less likely to be repeated, I suppose. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro 2016-07-01 16:30 ` Andy Lutomirski @ 2016-07-01 16:46 ` Borislav Petkov 2016-07-03 14:36 ` Andy Lutomirski 0 siblings, 1 reply; 6+ messages in thread From: Borislav Petkov @ 2016-07-01 16:46 UTC (permalink / raw) To: Andy Lutomirski Cc: Michal Hocko, linux-kernel@vger.kernel.org, stable, Andi Kleen, linux-mm@kvack.org, Linus Torvalds, Andrew Morton, X86 ML, Dave Hansen, Dave Hansen On Fri, Jul 01, 2016 at 09:30:37AM -0700, Andy Lutomirski wrote: > I put the ifdef there to prevent anyone from accidentally using it in > a 64-bit code path, not to save a bit. We could put in the middle of > the list to make the mistake much less likely to be repeated, I > suppose. Well, if someone does, someone will notice pretty soon, no? I just don't see the reason to worry but maybe I'm missing it. And we can call it X86_BUG_ESPFIX_X86_32 or so too... -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro 2016-07-01 16:46 ` Borislav Petkov @ 2016-07-03 14:36 ` Andy Lutomirski 2016-07-03 18:44 ` Borislav Petkov 0 siblings, 1 reply; 6+ messages in thread From: Andy Lutomirski @ 2016-07-03 14:36 UTC (permalink / raw) To: Borislav Petkov Cc: Dave Hansen, Michal Hocko, X86 ML, linux-mm@kvack.org, stable, Andrew Morton, linux-kernel@vger.kernel.org, Dave Hansen, Linus Torvalds, Andi Kleen On Jul 1, 2016 9:47 AM, "Borislav Petkov" <bp@alien8.de> wrote: > > On Fri, Jul 01, 2016 at 09:30:37AM -0700, Andy Lutomirski wrote: > > I put the ifdef there to prevent anyone from accidentally using it in > > a 64-bit code path, not to save a bit. We could put in the middle of > > the list to make the mistake much less likely to be repeated, I > > suppose. > > Well, if someone does, someone will notice pretty soon, no? Dunno. ESPFIX was broken under KVM for years and no one notices. > > I just don't see the reason to worry but maybe I'm missing it. > > And we can call it X86_BUG_ESPFIX_X86_32 or so too... We could do that, too, I guess. But the current solution is only two extra lines of code. We could reorder the things so that it's in the middle instead of at the end, I suppose. --Andy -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro 2016-07-03 14:36 ` Andy Lutomirski @ 2016-07-03 18:44 ` Borislav Petkov 0 siblings, 0 replies; 6+ messages in thread From: Borislav Petkov @ 2016-07-03 18:44 UTC (permalink / raw) To: Andy Lutomirski Cc: Dave Hansen, Michal Hocko, X86 ML, linux-mm@kvack.org, stable, Andrew Morton, linux-kernel@vger.kernel.org, Dave Hansen, Linus Torvalds, Andi Kleen On Sun, Jul 03, 2016 at 07:36:30AM -0700, Andy Lutomirski wrote: > Dunno. ESPFIX was broken under KVM for years and no one notices. Ah, so this really was the case already. :-\ > We could do that, too, I guess. But the current solution is only two > extra lines of code. We could reorder the things so that it's in the > middle instead of at the end, I suppose. Yeah, sounds good. Especially if it was already broken - I missed that fact. Thanks. -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-07-03 18:44 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20160701001209.7DA24D1C@viggo.jf.intel.com>
2016-07-01 0:12 ` [PATCH 1/6] x86: fix duplicated X86_BUG(9) macro Dave Hansen
2016-07-01 9:23 ` Borislav Petkov
2016-07-01 16:30 ` Andy Lutomirski
2016-07-01 16:46 ` Borislav Petkov
2016-07-03 14:36 ` Andy Lutomirski
2016-07-03 18:44 ` Borislav Petkov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).